GM ignition switch: how a silent redesign bypassed quality and cost 124 lives

Here is an uncomfortable observation. The most dangerous document in your plant is not the one that is wrong. It is the one that is correct but describes a part that no longer exists. That is what happened at General Motors. An engineer approved a design change to a safety-critical switch. The part number carried on as if nothing had happened. Every system downstream — FMEAs, service manuals, investigator timelines — pointed at a ghost.

The situation

The ignition switch was a small spring-loaded component, built for GM by Delphi. Its job was simple but safety-critical: hold the key in "Run" against the rotational forces a driver introduces through a dangling keychain, a bumpy road or an accidental nudge. When it worked, nobody thought about it. When it slipped, the car kept moving but the electrical system went dark — and so did the airbag deployment logic.

This was not a theoretical defect. Drivers lost steering assist and braking, struck objects, and the airbags did not fire. Frontal collisions that should have been survivable became fatal. Ordinary accidents turned lethal because the last line of defence had been silently switched off.

How it unfolded

The switch design traced back to the late 1990s. By the mid-2000s, GM engineers were aware it could slip under certain conditions. In 2006 a design change was approved — the detent plunger was modified to increase the torque required to turn the key, making it harder for the switch to rotate out of position on its own. In engineering terms, the correct fix. But the part number stayed the same. The revised switch carried the identical identifier as the defective one it replaced.

That single decision collapsed the traceability chain. Service technicians replacing switches after 2006 had no way of knowing whether the part they pulled from the bin was old specification or new. Investigators reviewing warranty claims and crash reports could not distinguish pre-change vehicles from post-change ones. When internal reviews asked whether the part had ever been modified, the answer — buried under an identical part number — appeared to be "no." The redesign hid itself.

Root-cause anatomy

Technically, the defect was a torque shortfall. The detent mechanism did not provide enough resistance to prevent key rotation under real-world loading — heavy keychains, vibration, angular momentum. The engineering specification for rotational force was too low. The validation testing did not reproduce the conditions under which a driver's keys would actually be loaded.

The organisational root cause is what makes this a quality-system study. GM's own procedures — like those of every IATF 16949-certified manufacturer — required that any design change trigger a documented revision, a new or revised part number, and notification to every downstream function from service to manufacturing. None of that happened in a way that preserved traceability. The change went through a side channel that bypassed the formal system. Whether it was convenience, cost avoidance or cultural habit matters less than the result: a safety-critical part was altered and the quality system never recorded it.

Change the part without changing the number and you haven't fixed a defect — you've buried it alive.

Where the quality system failed

Several controls collapsed at once, and each one is worth naming because the same architecture exists in every plant I have audited. Start with the change-control gate, the APQP Phase 4–5 checkpoint that should have stopped this cold. The redesign should have triggered a full Engineering Change Notice with a revised part number, updated drawing revision level and cascading notifications to PFMEA, control plan, work instructions and service documentation. The gate did not hold.

The PFMEA linkage failed next. The failure mode — ignition switch rotates out of Run during vehicle operation — should have carried a severity of 10: death or serious injury without warning. Any design change meant to mitigate that mode required a documented PFMEA update, a new prevention control and a re-evaluated RPN. There is no evidence the linkage was maintained. Audit traceability broke in parallel. Internal and external audits rely on part-number integrity to sample correctly. When the same number describes two physically different components, the audit trail is fiction. An auditor reviewing 2008 production records would see a part number that, on paper, had never changed — and move on to the next line item.

The CAPA loop was the last domino. Field complaints and warranty data tied to this switch should have fed into corrective and preventive action. But because the part number was unchanged, the 8D teams investigating crash reports could not identify which vehicles carried the revised switch and which still had the original defect. The corrective action was already somewhere in the supply chain. Nobody could find it.

What would have caught it

Any one of these controls, functioning as designed, would have exposed the silent redesign before it became a decade-long catastrophe:

• Forced part-number revision on any ECN touching a safety-critical characteristic. No exceptions. If the detent torque spec changes, the part number changes. That is not bureaucracy — it is the address system for every other quality tool you run.
• A PFMEA review trigger keyed to drawing revisions. When the drawing changes, the PFMEA opens. No PFMEA update, no drawing release. This coupling must be system-enforced, not left to an engineer's judgement.
• Cross-functional change-review boards with mandatory service and aftermarket representation. If the people who maintain service manuals and parts catalogues cannot trace the change to the field, the change does not ship.
• Periodic physical-to-drawing verification audits. Pull a part from inventory. Measure it. Compare against the revision the system claims it represents. If they do not match, you have a ghost in your system.

My take

In every plant I have run quality in — SNOP, WITTE, Airbus — I have enforced one rule that makes engineers uncomfortable: the part number is sacred. I have rejected Engineering Change Notices that tried to slip a dimensional change through under an existing number because "it's only a tolerance tightening." It is never only anything. That tolerance tightening changes how the part behaves in the field, how an investigator traces a failure, and how a recall is scoped. I have felt the pressure firsthand — skip the re-qualification cost, skip the documentation drag, get the fix out quietly. At SNOP, where I built the QA/QC function from zero for over 900 people on a greenfield site, the change-control gate was the one process I personally refused to compromise on. Not because I love paperwork. Because I have seen what happens when the paper no longer matches the steel.

The GM ignition switch case is not a story about a bad switch. It is a story about a quality system that was intact on paper and functionally blind in practice. The redesign was correct. The documentation was the defect. And 124 people paid the price for a part number that told a lie.